For teams · the questions a solo developer never asks
What a team lead needs answered first
Six objections, answered with what is true today rather than with a roadmap. Where a commercial term is not published yet, this page says so instead of inventing one.
We need SOC 2 before we can evaluate a vendor.
SHPBL holds no SOC 2 or ISO certification and we will not promise a date. What exists instead: the evaluation path needs no key, no card and no account, a free run retains no repository content, no report and no library, and nothing is written to your repository without a signed authorisation you issue. If a certification is a hard gate, evaluate the offline library as files — it makes no network call at all.
How do keys work for more than one engineer?
A Practitioner key is per person, usable on unlimited machines and in CI. There is no device limit and no seat count to reconcile. Team and volume terms are not published yet — write to the address below and you will get a straight answer from the maintainer rather than a quote generator.
What happens when we hit 100,000 calls in a month?
Paid tools stop at call 100,001 and the refused call is not charged; the keyless free tools keep working. There are no billed overages, and one courtesy ceiling lift is available on request.
Does it sit in our production path?
No. Your agent, your script or your CI does the work in your repository. SHPBL is called during a run and holds no runtime position in your product. The $499 edition removes the network call entirely.
It is one maintainer. What happens if he stops?
That risk is real and this is the honest mitigation: every release ships as sealed files with a published SHA-256 checksum, the $499 edition is a perpetual licence to files you already hold, and the method is documented in full in the User's Manual. Nothing you have bought stops working if the server does.
Can we see it fail before we buy?
Yes — six real runs are published, five of which did not return a clean buy, including the run pointed at this site. The reports are downloadable unedited.
developer / CI job
│ (your machine, your credentials)
▼
┌──────────────────────┐ ┌──────────────────────────┐
│ your agent or │ ─────▶ │ SHPBL (MCP / HTTP / SDK) │
│ script │ ◀───── │ capability evidence │
└──────────┬───────────┘ └──────────────────────────┘
│ writes here, and only here
▼
┌──────────────────────┐
│ your repository │ branch ▸ pull request ▸ your review
│ + .shpbl/ library │
└──────────────────────┘
never in the path: your production runtime, your customer data- ─▶Request out. Nothing is pushed to you.
- ▸A human approval step you already own.
Evaluate before you procure
Nothing about the free path requires a vendor review: no key, no card, no account, and nothing retained. Point it at a repository, read the report, then decide whether a purchase conversation is worth anyone's time.
Free evaluation
Reads and reports, then stops
Practitioner · $39/mo
Runs the full gauntlet, keeps every run
Complete Master Library · $499
Owns the catalogue as files, perpetually
Every lane audits your repository honestly. The paid lanes are the ones that compose, verify, deliver and leave a reusable library behind.
Mesh
One library, read by every agent that opens the repository.
The shelf is a shared surface: whoever picks up the work next reads the same named, cited capabilities instead of restarting the conversation from nothing.